Final Draft Solicitation Ascend BPA Appendix B Definitions.pdf

Appendix B: Definitions Term Definition

A Active Service A cloud service (i.e., IaaS, PaaS, SaaS) that has been allocated resources and is in an active performance state (i.e., actively processing data).

Administrative Agency General Services Administration

Agency1 An entity that is a federal government executive department, military department, federal government corporation, federal government-controlled corporation, or other establishment in the executive branch of the federal government (including the Executive Office of the President), or any independent regulatory agency, but does not include - (A) the Government Accountability Office; (B) Federal Election Commission; (C) the governments of the District of Columbia and of the territories and possessions of the United States, and their various subdivisions; or (D) federal government-owned contractor-operated facilities, including laboratories engaged in national defense research and production activities.

Application Programming Interface

(API)

A set of specifications, definitions, and protocols used in building and integrating software applications.

Authorized Reseller An entity that has been explicitly authorized (e.g., contractual agreement) by a cloud service provider (CSP) to act as an authorized agent or intermediary (e.g., cloud broker) to offer, negotiate, and sell, on the behalf of the CSPs, the CSP's cloud services.

1 44 U.S.C. 3502 PRINTING AND DOCUMENTS, Definitions

B Broad Network Access 2 Cloud services are available over the network and accessed through standard mechanisms that promote use by heterogeneous thin or thick client platforms (e.g., mobile phones, tablets, laptops, and workstations).

C Carbon Pollution-Free Electricity

(CFE)3

Electrical energy produced from resources that generate no carbon emissions, including marine energy, solar, wind, hydrokinetic (including tidal, wave, current, and thermal), geothermal, hydroelectric, nuclear, renewably sourced hydrogen, and electrical energy generation from fossil resources to the extent there is active capture and storage of carbon dioxide emissions that meets EPA requirements.

Cloud Service Provider (CSP) An entity that directly operates and manages the cloud services (i.e., IaaS, PaaS, SaaS) technology (e.g., facility, hardware, software).

Cloud Service Provider Account The primary, master, or root account that establishes the cloud services (i.e., IaaS, PaaS, SaaS) business, operational, and management relationship (e.g., on-demand self-service, measured services) between the authorized vendor (i.e., CSP, authorized reseller) and the eligible user.

Cloud Service Offering (CSO) See IaaS, PaaS,SaaS

Cloud-Related IT Professional Services Providers

An entity that provides manpower (i.e., labor) with specialized knowledge, skills, and abilities of cloud services.

Commercial Service4 Type of service offered and sold competitively in substantial quantities in the commercial marketplace based on established catalog or market prices for specific tasks performed or specific outcomes to be achieved and under standard commercial terms and conditions.

Concurrently Maintainable The Cloud Service Provider (CSP) is capable

2 NIST, SP 800-145: The NIST Definition of Cloud Computing, Essential Characteristics 3 Executive Order 14057: Clean Energy Industries and Jobs; Efforts To Catalyze Through Federal Sustainability 4 FAR 2.101 Definitions of performing maintenance of data center infrastructure (e.g., HVAC, network, power) while continuing to provide cloud services (i.e., IaaS, PaaS, SaaS) uninterrupted.

Confidentiality Agreement Legal agreement that binds one or more parties to non-disclosure of confidential information.

Continental United States (CONUS) The 48 connected states that make up the United States and the District of Columbia.

Contractors Entities (i.e., CSP, authorized reseller) that have an Ascend BPA award issued by the administrative agency.

Cost Allocation Cost allocation is the process of identifying, aggregating, and assigning costs to cost objects. A cost object is any activity or item for which you want to separately measure costs.

Community Cloud5 The cloud infrastructure is provisioned for exclusive use by a specific community of consumers from organizations that have shared concerns (e.g., mission, security requirements, policy, and compliance considerations). It may be owned, managed, and operated by one or more of the organizations in the community, a third party, or some combination of them, and it may exist on- or off-premises.

Credential Any physical (e.g., placard, RFID key fob, smart card) or virtual (e.g., digital certificate, username/password) means or mechanisms issued by an eligible user to an authorized vendor's person that identifies and or provides authorized vendor's person access, permissions, or privileges to buildings, facilities, properties, or IS.

Critical Infrastructure Systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national

5 NIST, SP 800-145: The NIST Definition of Cloud Computing, Service Models public health or safety, or any combination of those matters.

Cybersecurity Incident An event that actually or potentially jeopardizes the confidentiality, integrity, and availability (CIA) of application marketplaces services (i.e., CSP application marketplaces, third-party application marketplaces), authorized vendors' IS, cloud services (i.e., IaaS, PaaS, SaaS), or eligible users' IS.

D Data Any information (e.g.,audio, mathematical, synthetic, text, visual) that has been formatted or structured (e.g., binary, machine code) for processing, storage, or transceiving by digital and non-digital means (e.g., analog circuits, computers, digital circuits, processors, magnetic memories, optical storage).

Data Management Incident An event that actually or potentially jeopardizes the CIA of authorized vendors' data or eligible users' data.

Denial of Service (DoS) Activity that denies, degrades, or disrupts normal functionality of an IS (e.g., cloud service) or connectivity (e.g., network).

Department of Defense Cloud Authorization Services

A DoD program that provides a standardized approach to security assessments, authorizations, and continuous monitoring of CSOs.

Deployment Model The highest-level categorization of cloud services based on what users the cloud services are made available to (i.e., public, community, private, hybrid).

E Eligible User An eligible user is any federal, state, local, tribal, and territorial (FSLTT) government or other eligible entity that is authorized to use the GSA multiple award schedule (MAS) federal supply schedule (FSS).

F Federal Risk and Authorization Management Program (FedRAMP)

FedRAMP standardizes security requirements for the authorization and ongoing cybersecurity of cloud services in accordance with FISMA, OMB Circular A-130, and FedRAMP policy, and FedRAMP Authorization Act as part of the National Defense Authorization Act.

FedRAMP Authorization A certification that a cloud computing product or service has completed the FedRAMP authorization process according to current legislative guidance.

FedRAMP Authorization Package Security package that identifies NIST security controlsThe essential information that can be used by an agency to determine whether to authorize the operation of a cloud information system or the use of a designated set of common controls for all cloud computing products and services authorized by FedRAMP.6, 7

6 James M. Inhofe National Defense Authorization Act for Fiscal Year 2023, Public Law 117-263, Division E Non-Department of Defense Matters, Title LIX Other Matters, Subtitle C FedRAMP Authorization Act, Sec. 5921 FedRAMP Authorization Act 7 44 U.S.C. 3607 et seq. PUBLIC PRINTING AND DOCUMENTS, Definitions https://www.congress.gov/bill/113th-congress/senate-bill/2521 https://www.cio.gov/policies-and-priorities/circular-a-130/ https://www.congress.gov/117/bills/hr7776/BILLS-117hr7776enr.pdf#page=1055 https://www.congress.gov/117/bills/hr7776/BILLS-117hr7776enr.pdf#page=1055

G Government Data Any information regardless of form or characteristic that is created or obtained while supporting a government entity.

H High Availability Data Center A data center that is concurrently maintainable and complaint with at least one (1) of the following standards:

● ANSI/BICSI 002-2019, Data Center Design and Implementation Best Practices, Availability Class 3

● ANSI/TIA-942 Telecommunications Infrastructure Standard for Data Centers, Rated-3 Concurrently Maintainable Site Infrastructure

● Uptime Institute, Tier III Concurrently Maintainable

Hybrid Cloud8 The cloud infrastructure is a composition of two or more distinct cloud infrastructures (private, community, or public) that remain unique entities, but are bound together by standardized or proprietary technology that enables data and application portability (e.g., cloud bursting for load balancing between clouds).

I Infrastructure as a Service (IaaS)9 The capability provided to the eligible user to provision processing, storage, networks, and other fundamental computing resources where the eligible user is able to deploy and run arbitrary software, which can include operating systems and applications. The eligible user does not manage or control the underlying cloud infrastructure but has control over operating systems, storage, and deployed applications; and possibly limited control of select networking components (e.g., host firewalls).

Infrastructure as Code (IaC) The process of managing and provisioning IT infrastructure using machine-readable configuration files.

8 NIST, SP 800-145: The NIST Definition of Cloud Computing, Service Models 9 NIST, SP 800-145: The NIST Definition of Cloud Computing, Service Models

Institution of Higher Education10, 11 An educational institution in any state that admits as regular students only persons having a certificate of graduation from a school providing secondary education, or the recognized equivalent of such a certificate; is legally authorized within such State to provide a program of education beyond secondary education; provides an educational program for which the institution awards a bachelor’s degree or provides not less than a two-year program that is acceptable for full credit toward such a degree, or awards a degree that is acceptable for admission to a graduate or professional degree program, subject to review and approval by the Secretary; is a public or other nonprofit institution; and is accredited by a nationally recognized accrediting agency or association, or if not so accredited, is an institution that has been granted pre-accreditation status by such an agency or association that has been recognized by the Secretary for the granting of pre-accreditation status, and the Secretary has determined that there is satisfactory assurance that the institution will meet the accreditation standards of such an agency or association within a reasonable time.

J

K

L Law Enforcement Entity An entity with jurisdiction for the oversight (e.g., Office of Inspector General [OIG]) or law enforcement (e.g., National Cyber Investigative Joint Task Force [NCIJTF], Department of Justice [DoJ], Federal Bureau of Investigation [FBI], state police, university police) of or for the administrative agency or eligible users.

Local Educational Agency12, 13 A board of education or other legally constituted local school authority having

10 40 U.S.C. 502(c) 11 10 U.S.C. 1001 EDUCATION, General definition of institution of higher education 12 40 U.S.C. 502(c) 13 Elementary and Secondary Education Act of 1965 administrative control and direction of free public education in a county, township, independent school district, or other school district; and includes any state agency that directly operates and maintains facilities for providing free public education.

Log A file containing data about an event that occurred in an application (e.g., operating system), cloud service (i.e., IaaS, PaaS, SaaS), or hardware (e.g., appliance, device).

Lossless No data is lost in the processing of the data (e.g., compression) and when the process is reversed (e.g., decompression) the original data is fully restored.

Lossy Data is lost in the processing of the data (e.g., compression) and when the process is reversed (e.g., decompression) the original data is not fully restored.

M Malicious Logic Installation of software (e.g., malware) designed and/or deployed by adversaries with malicious intentions for the purpose of gaining access to resources or information without the consent or knowledge of the user. This only includes malicious code that does not provide remote interactive control of the compromised IS. Malicious code that has allowed interactive access should be categorized as root- or user-level Intrusion incidents. Interactive active access may include automated tools that establish an open channel of communications to and/or from an IS (e.g., cloud services).

Measured Service14 Cloud systems automatically control and optimize resource use by leveraging a metering capability at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency for both the authorized vendor (i.e., CSP, authorized reseller) and the eligible user of the utilized service.

N Nearsider An individual that has physical access to the hardware but does not have logical access to the actual data.

Non-Disclosure Agreement (NDA) Delineates specific information, materials, or knowledge that the signatories agree not to release or divulge to any other parties.

O Outside the Continental United States (OCONUS)

All geographical areas outside of the 48 connected states that make up the continental United States and the District of Columbia.

On-Demand Self-Service 15 An eligible user can unilaterally provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with each authorized vendor (i.e.,CSP, authorized reseller).

P Personally Identifiable Information

(PII)

Information that can be used to distinguish or trace an individual's identity, such as their name, social security number, biometric records, etc. alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc.

Platform as a Service (PaaS)16 The capability provided to the eligible user to deploy onto the cloud infrastructure eligible user-created or acquired applications created using programming languages, libraries, services, and tools supported by the

14 NIST, SP 800-145: The NIST Definition of Cloud Computing, Essential Characteristics 15 NIST, SP 800-145: The NIST Definition of Cloud Computing, Essential Characteristics 16 NIST, SP 800-145: The NIST Definition of Cloud Computing, Service Models authorized vendor (i.e., CSP, authorized reseller). The eligible user does not manage or control the underlying cloud infrastructure including network, servers, operating systems, or storage, but has control over the deployed applications and possibly configuration settings for the application-hosting environment.

Private Cloud17 The cloud infrastructure is provisioned for exclusive use by a single organization comprising multiple consumers (e.g., business units). It may be owned, managed, and operated by the organization, a third party, or some combination of them, and it may exist on or off premises.

Public Cloud18 The cloud infrastructure is provisioned for open use by the general public. It may be owned, managed, and operated by a business, academic, or government organization, or some combination of them. It exists on the premises of the cloud provider.

17 NIST, SP 800-145: The NIST Definition of Cloud Computing, Service Models 18 NIST, SP 800-145: The NIST Definition of Cloud Computing, Service Models

Q

R Ransomeware Malware designed to encrypt data (e.g., files) on a device (e.g., cloud storage), rendering any IS (e.g., cloud services) that relies on the data unusable. Malicious actors then demand ransom in exchange for decryption.

Ransomware actors often target and threaten to sell or leak exfiltrated data or authentication information if the ransom is not paid.

Ransomware is a reportable incident that may be associated with multiple incident categories depending on the attack vector and execution.

Rapid Elasticity19 Cloud services can be elastically provisioned and released, in some cases automatically, to scale rapidly outward and inward commensurate with demand. To the eligible user, the capabilities available for provisioning often appear to be unlimited and can be appropriated in any quantity at any time.

Resource Pooling20 The authorized vendor's (i.e., CSP, authorized reseller) computing resources are pooled to serve multiple eligible users using a multi-tenant model, with different physical and virtual resources dynamically assigned and reassigned according to eligible users' demand. There is a sense of location independence in that the eligible users generally have no control or knowledge over the exact location of the provided resources but may be able to specify location at a higher level of abstraction (e.g., country, state, or datacenter). Examples of resources include storage, processing, memory, and network bandwidth.

Root-Level Intrusion Unauthorized privileged access to an IS (e.g., cloud service). Privileged access, often referred to as administrative or root access, provides unrestricted access to the IS. This category includes unauthorized access to information or unauthorized access to account credentials that could be used to perform

19 NIST, SP 800-145: The NIST Definition of Cloud Computing, Essential Characteristics 20 NIST, SP 800-145: The NIST Definition of Cloud Computing, Essential Characteristics administrative functions (e.g., domain administrator). If the IS is compromised with malicious code that provides remote interactive control, it will be reported in this category.

S Scalability Cloud services can increase (e.g., outward) or decrease (e.g., inward) commensurate with demand.

Self-Service The ability of a user to independently perform actions without any human interactions or third-party approval.

Service Model21 The highest-level categorization of cloud services as based on the type of computing capability that is provided.

Software as a Service (SaaS)22 The capability provided to the eligible user to use the authorized vendor's applications running on a cloud infrastructure. The applications are accessible from various client devices through either a thin client interface, such as a web browser (e.g., web-based email), or a program interface. The eligible user does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings.

State or Local Government23 An entity that is a state, local, regional, or tribal government, or any instrumentality thereof (including any local educational agency or institution of higher education).

Suspended Service A cloud service (i.e., IaaS, PaaS, SaaS) that has been allocated resources but is in a paused performance state (i.e., not actively processing data).

Synthetic Data Information that is artificially generated rather than produced by real-world events.

21 NIST, SP 800-145: The NIST Definition of Cloud Computing, Service Models 22 NIST, SP 800-145: The NIST Definition of Cloud Computing, Service Models 23 40 U.S.C. 502(c)

T Tier 0 Operational Support Consists of self-help and user-retrieved information support (e.g., blog posts, bots, CBT, community forums, FAQ, how-tos, manuals, technical information).

Tier 1 Operational Support Consists of resources responsible for resolving basic and standard cases (e.g., help desk tickets, incidents, requests, work orders) for the authorized vendors' cloud services (i.e., IaaS, PaaS, SaaS).

Tier 2 Operational Support Consists of resources that are experienced and knowledgeable in troubleshooting the authorized vendors' cloud services (i.e., IaaS, PaaS, SaaS).

Tier 3 Operational Support Consists of the highest level of resources that have specialized experience and knowledge in troubleshooting the authorized vendors' cloud services (i.e., IaaS, PaaS, SaaS).

Terminated Service A cloud service (i.e., IaaS, PaaS, SaaS) that has been terminated and allocated resources released.

Tribal Government24 An entity that is the governing body of any Indian tribe, band, nation, or other organized group or community located in the continental United States (excluding the state of Alaska) that is recognized as eligible for the special programs and services provided by the United States to Indians because of their status as Indians, and any Alaska Native regional or village corporation established pursuant to the Alaska Native Claims Settlement Act.

U User-Level Intrusion Unauthorized non-privileged access to an IS (e.g., cloud service). Non-privileged access, often referred to as user-level access, provides restricted access to the IS based on the privileges granted to the user. This includes unauthorized access to information or unauthorized access to account credentials that could be used to perform user functions such as accessing web applications, web portals, or other similar information resources.

24 40 U.S.C. 502(c)

If the IS is compromised with malicious code that provides remote interactive control, it will be reported in this category.

Unit of Measure A definite magnitude of a quantity that is used as a standard measurement for a defined cloud service (e.g., compute per hour, labor hour, subscription, transaction).

Utilization-Based Discounts An offer of Increasing levels of discounting based on increasing consumption of the product or service.

V

W

X

Y

Z